I have a local domain (let's call it mycorp.local).
On one computer, I setup a VPN connexion to a remote domain (let's suppose it's DNS suffix is remote.local).
As soon as I establish the remote connection, the local domain authentication stop to works. For example, I try to connect to a SQL server using integrated authentication, but it fails with this error:
Login failed. The login is from an untrusted domain and cannot be used with Windows authentication. (Microsoft SQL Server, Error: 18452)
If I disconnect the VPN, I can login again to SQL.
Both domain has no trust relationship.
My first guess was that the VPN connection take precedence over local DNS. That's why I followed this answer : VPN Connection causes DNS to use wrong DNS server. Basically, the answer allowed to change the order of interface to try dns resolution.
I assume the DNS setup is correct, be cause I can ping both sql and ad computers when the VPN is established.
Is there any parameter/config to apply to ensure authentication occurs on the correct domain?
If it can help, here are some details on my setup:
- 2 network cards
- 1 that can access to the AD network
- 1 with internet access
- local subnet: 192.168.10.0/24. Metric set to 1
- second card's subnet: 192.168.66.0/24. Metric set to 100
- VPN's connection's subnet: 172.16.0.0/16. Metric set to 9999
In all cases, ping sql, ping sql.mycorp.local, ping ad and ping ad.mycorp.local are correctly resolving IP addresses (of course with some ipconfig /flushdns to be sure).
The complete output of ipconfig /all is:
Windows IP Configuration
Host Name . . . . . . . . . . . . : mycomputer
Primary Dns Suffix . . . . . . . : mycorp.local
Node Type . . . . . . . . . . . . : Hybrid
IP Routing Enabled. . . . . . . . : No
WINS Proxy Enabled. . . . . . . . : No
DNS Suffix Search List. . . . . . : mycorp.local
remote.local
Ethernet adapter Local:
Connection-specific DNS Suffix . : mycorp.local
Description . . . . . . . . . . . : Microsoft Hyper-V Network Adapter #3
Physical Address. . . . . . . . . : 00-15-5D-14-20-0D
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::d117:9048:ce1c:1422%16(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.10.30(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Default Gateway . . . . . . . . . :
DHCPv6 IAID . . . . . . . . . . . : 385881437
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-19-8B-E5-3D-00-15-5D-14-20-0F
DNS Servers . . . . . . . . . . . : fe80::80ce:dc9d:37c5:39f3%16
192.168.10.10
NetBIOS over Tcpip. . . . . . . . : Enabled
Ethernet adapter RJ45:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Hyper-V Network Adapter #2
Physical Address. . . . . . . . . : 00-15-5D-14-20-0E
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
IPv6 Address. . . . . . . . . . . : 2a01:e35:8a84:7240:c0eb:c8d1:9c3f:8fc0(Preferred)
Link-local IPv6 Address . . . . . : fe80::c0eb:c8d1:9c3f:8fc0%13(Preferred)
IPv4 Address. . . . . . . . . . . : 192.168.66.11(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.0
Lease Obtained. . . . . . . . . . : lundi 12 août 2013 13:06:28
Lease Expires . . . . . . . . . . : jeudi 22 août 2013 13:06:28
Default Gateway . . . . . . . . . : fe80::207:cbff:fe3c:5b7f%13
192.168.66.254
DHCP Server . . . . . . . . . . . : 192.168.66.254
DNS Servers . . . . . . . . . . . : fe80::80ce:dc9d:37c5:39f3%13
192.168.10.10
NetBIOS over Tcpip. . . . . . . . : Enabled
Ethernet adapter Wifi:
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft Hyper-V Network Adapter
Physical Address. . . . . . . . . : 00-15-5D-14-20-0F
DHCP Enabled. . . . . . . . . . . : Yes
Autoconfiguration Enabled . . . . : Yes
Link-local IPv6 Address . . . . . : fe80::c551:f03f:7557:9b17%11(Preferred)
Autoconfiguration IPv4 Address. . : 169.254.155.23(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.0.0
Default Gateway . . . . . . . . . :
DHCPv6 IAID . . . . . . . . . . . : 234886493
DHCPv6 Client DUID. . . . . . . . : 00-01-00-01-19-8B-E5-3D-00-15-5D-14-20-0F
DNS Servers . . . . . . . . . . . : fe80::80ce:dc9d:37c5:39f3%11
192.168.10.10
NetBIOS over Tcpip. . . . . . . . : Enabled
PPP adapter VPN remote:
Connection-specific DNS Suffix . : remote.local
Description . . . . . . . . . . . : VPN remote
Physical Address. . . . . . . . . :
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
IPv4 Address. . . . . . . . . . . : 172.16.110.243(Preferred)
Subnet Mask . . . . . . . . . . . : 255.255.255.255
Default Gateway . . . . . . . . . :
DNS Servers . . . . . . . . . . . : 172.16.100.47
172.16.100.43
Primary WINS Server . . . . . . . : 172.16.100.47
Secondary WINS Server . . . . . . : 172.16.122.100
NetBIOS over Tcpip. . . . . . . . : Enabled
Tunnel adapter isatap.{DEFE2CAC-D001-4E79-A33F-AD95A8106CA8}:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Tunnel adapter Local Area Connection* 9:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Teredo Tunneling Pseudo-Interface
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Tunnel adapter isatap.{2AE1C64F-102F-48B4-A60A-AA28461A96EF}:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . :
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #2
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Tunnel adapter isatap.remote.local:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : remote.local
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #3
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
Tunnel adapter isatap.mycorp.local:
Media State . . . . . . . . . . . : Media disconnected
Connection-specific DNS Suffix . : mycorp.local
Description . . . . . . . . . . . : Microsoft ISATAP Adapter #4
Physical Address. . . . . . . . . : 00-00-00-00-00-00-00-E0
DHCP Enabled. . . . . . . . . . . : No
Autoconfiguration Enabled . . . . : Yes
The complete route print command's output is:
===========================================================================
Interface List
16...00 15 5d 14 20 0d ......Microsoft Hyper-V Network Adapter #3
13...00 15 5d 14 20 0e ......Microsoft Hyper-V Network Adapter #2
11...00 15 5d 14 20 0f ......Microsoft Hyper-V Network Adapter
28...........................VPN Remote
1...........................Software Loopback Interface 1
12...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter
14...00 00 00 00 00 00 00 e0 Teredo Tunneling Pseudo-Interface
15...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #2
17...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #3
18...00 00 00 00 00 00 00 e0 Microsoft ISATAP Adapter #4
===========================================================================
IPv4 Route Table
===========================================================================
Active Routes:
Network Destination Netmask Gateway Interface Metric
0.0.0.0 0.0.0.0 192.168.66.254 192.168.66.11 100
77.245.100.10 255.255.255.255 192.168.66.254 192.168.66.11 101
127.0.0.0 255.0.0.0 On-link 127.0.0.1 306
127.0.0.1 255.255.255.255 On-link 127.0.0.1 306
127.255.255.255 255.255.255.255 On-link 127.0.0.1 306
169.254.0.0 255.255.0.0 On-link 169.254.155.23 261
169.254.155.23 255.255.255.255 On-link 169.254.155.23 261
169.254.255.255 255.255.255.255 On-link 169.254.155.23 261
172.16.0.0 255.255.0.0 172.16.110.240 172.16.110.243 10000
172.16.110.243 255.255.255.255 On-link 172.16.110.243 10255
192.168.10.0 255.255.255.0 On-link 192.168.10.30 257
192.168.10.30 255.255.255.255 On-link 192.168.10.30 257
192.168.10.255 255.255.255.255 On-link 192.168.10.30 257
192.168.66.0 255.255.255.0 On-link 192.168.66.11 356
192.168.66.11 255.255.255.255 On-link 192.168.66.11 356
192.168.66.255 255.255.255.255 On-link 192.168.66.11 356
224.0.0.0 240.0.0.0 On-link 127.0.0.1 306
224.0.0.0 240.0.0.0 On-link 192.168.10.30 257
224.0.0.0 240.0.0.0 On-link 192.168.66.11 356
224.0.0.0 240.0.0.0 On-link 169.254.155.23 261
224.0.0.0 240.0.0.0 On-link 172.16.110.243 10255
255.255.255.255 255.255.255.255 On-link 127.0.0.1 306
255.255.255.255 255.255.255.255 On-link 192.168.10.30 257
255.255.255.255 255.255.255.255 On-link 192.168.66.11 356
255.255.255.255 255.255.255.255 On-link 169.254.155.23 261
255.255.255.255 255.255.255.255 On-link 172.16.110.243 10255
===========================================================================
Persistent Routes:
None
IPv6 Route Table
===========================================================================
Active Routes:
If Metric Network Destination Gateway
13 356 ::/0 fe80::207:cbff:fe3c:5b7f
1 306 ::1/128 On-link
13 108 2a01:e35:8a84:7240::/64 On-link
13 356 2a01:e35:8a84:7240:c0eb:c8d1:9c3f:8fc0/128
On-link
16 257 fe80::/64 On-link
13 356 fe80::/64 On-link
11 261 fe80::/64 On-link
13 356 fe80::c0eb:c8d1:9c3f:8fc0/128
On-link
11 261 fe80::c551:f03f:7557:9b17/128
On-link
16 257 fe80::d117:9048:ce1c:1422/128
On-link
1 306 ff00::/8 On-link
16 257 ff00::/8 On-link
13 356 ff00::/8 On-link
11 261 ff00::/8 On-link
===========================================================================
Persistent Routes:
None
[Edit] To follow up TheCleaner's comment.
klist purge
klist
outputs:
Current LogonId is 0:0x6a9a3
Deleting all tickets:
Ticket(s) purged!
Current LogonId is 0:0x6a9a3
Cached Tickets: (0)
Start the program and try to connect (Sql Management Studio). Success, then:
sqlcmd -S sql -E -Q "select getdate()"
klist
outputs:
Current LogonId is 0:0x6a9a3
Cached Tickets: (0)
Established the VPN connection, then:
sqlcmd -S sql -E -Q "select getdate()"
klist
outputs:
Sqlcmd: Error: Microsoft SQL Server Native Client 11.0 : Login failed. The login is from an untrusted domain and cannot be used with Windows authentication..
Current LogonId is 0:0x6a9a3
Cached Tickets: (1)
#0> Client: steve @ mycorp.LOCAL
Server: krbtgt/mycorp.LOCAL @ mycorp.LOCAL
KerbTicket Encryption Type: RSADSI RC4-HMAC(NT)
Ticket Flags 0x40e00000 -> forwardable renewable initial pre_authent
Start Time: 8/12/2013 15:14:22 (local)
End Time: 8/13/2013 1:14:22 (local)
Renew Time: 8/19/2013 15:14:22 (local)
Session Key Type: RSADSI RC4-HMAC(NT)
[Edit 2] After activating the kerberos event logging, I get a specific event log:
A Kerberos Error Message was received:
on logon session
Client Time:
Server Time: 19:18:33.0000 8/12/2013 Z
Error Code: 0x7 KDC_ERR_S_PRINCIPAL_UNKNOWN
Extended Error:
Client Realm:
Client Name:
Server Realm: remote.LOCAL
Server Name: MSSQLSvc/sql:1433
Target Name: MSSQLSvc/sql:1433@remote.LOCAL
Error Text:
File: 9
Line: f09
Error Data is in record data.
If you look at the realm, you will see that the realm is no mycorp.local but remote.local.
Best Answer
I finally found an easy way to solve the issue.
The solution is taken from this technet thread.
Setting the
UseRasCredentialsparameter to0in the VPN connection file (.pbk) solved the issue.I deduct this parameter tells windows not to use the credentials of the VPN connection. I then have to input my login/password each time I connect to something in the remote network, but I'm ok with that.
As the post said, beware that editing the connection with the GUI reset this parameter to 1.